oss-sec mailing list archives

Re: CVE id request: mod_suphp

From: "Steven M. Christey" <coley () linus mitre org>
Date: Wed, 2 Apr 2008 11:04:38 -0400 (EDT)


======================================================
Name: CVE-2008-1614
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1614
Reference: MLIST:[suPHP] 20080330 SECURITY ISSUE: Immediate update advised
Reference: URL:http://lists.marsching.biz/pipermail/suphp/2008-March/001750.html

suPHP before 0.6.3 allows local users to gain privileges via (1) a
race condition that involves multiple symlink changes to point a file
owned by a different user, or (2) a symlink to the directory of a
different user, which is used to determine privileges.

Current thread:

CVE id request: mod_suphp Tomas Hoger (Apr 01)
- Re: CVE id request: mod_suphp Steven M. Christey (Apr 02)